Robust Optimization of IT Security Safeguards Using Standard Security Data

Abstract

Finding an appropriate IT security strategy by implementing the right security safeguards is a challenging task. Many organizations try to address this problem by obtaining an IT security certificate from a recognized standards organization. However, in many cases the requirements of a standard are too extensive to be implemented, particularly by smaller organizations. But the knowledge contained in a security standard may still be used to improve security. Organizations that have an interest in security but not in a certificate, face the challenge of utilizing this knowledge and selecting appropriate safeguards from the given standard. To solve this problem, a new robust optimization model to determine an optimal safeguard configuration is proposed. By incorporating multiple threat scenarios, obtained solutions are robust against uncertain security threats.